The identification of a computer that has attacked a business or governmental network application may be of paramount importance for prevention of unauthorized attacks and for law enforcement purposes, if required. Computer attacks with intentions to access or destroy information, whether the information is secured or not, continues to be a major issue for computerized operations.
Controlling access to databases or services typically includes levels of password security or authentication procedures to exclude unauthorized access. However, even with these security measures, attacks are frequently successful. Once an attack has occurred, reconstructing information related to the intrusion may be then difficult, if not impossible.
In a situation when the attack may be aimed at gaining access to the system, as opposed to “denial of service” type of attack, identification of the attacker may be impeded by at least the following circumstances:
(i) the fact that immediately before attempting the attack, when the login screen is requested and displayed, the potential intruder may not be distinguished from the legitimate application user, and
(ii) at the moment when the system may be able to classify the access attempt as being a possible attack, rather than a legitimate login, the attacker often has already been warned, e.g., by an “Invalid userID” or “Invalid Password” message. The attacker may be either gone or on a higher alert level, so it may be too late to take steps aimed at identifying the attacking computer.
Currently, capturing identifying information of a potential intruder, before or concurrent with a network access, does not exist. If such identifying information and specific connection related data were to be accumulated, stored and catalogued then a basis for reconstructing the identity of an attacker may be possible. Once identifying information has been captured, legal recourse may be more easily accomplished.